ืืืฆื
ืืื ืืืคืฉ. ืื ื ืฉืืชื ืงืคื. ืืชืืืื ืืงืื ืืืืืจ VPN ืืื ืฉืชื ื ืงืืืืช ืื ืขืื. ืื ื ืืืืง: ืืืืช ืืฉ ืื ืืจื, ืืื ืืื ืชื ืืขื ืืื ืืจื. ืืชืืืื ืืื ื ืขืื ื ืืฉืืืืช.
ืื ื ืฉื ืืช ืืงืืืงืื ืืฆืืื ืืชืื ืฉืขืจ S-Terra ืคืชืจืื ืืขืืืช. ืื ื ืืืืง ืืช ืื ืืกืืื ืืืืชืืืืืืืื ืฉืื.
ื ืชืื ืื ืืืืืืื
ืฉื ื ืืืชืจืื ืืืืคืจืืื ืืืืืืจืคืืช ืืืืืจืื ืืื ืืจืช GRE. GRE ืฆืจืื ืืืืืช ืืืฆืคื:
ืื ื ืืืืง ืืช ืืคืื ืงืฆืืื ืืืืช ืฉื ืื ืืจืช GRE. ืืฉื ืื, ืื ื ืืจืืฅ ืคืื ื ืืืืฉืืจ R1 ืืืืฉืง GRE ืฉื ืืืฉืืจ R2. ืืืื ืชืขืืืจืช ืืืขื ืืืฆืคื ื. ืืื ืชืฉืืื:
root@R1:~# ping 1.1.1.2 -c 4
PING 1.1.1.2 (1.1.1.2) 56(84) bytes of data.
--- 1.1.1.2 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3057ms
ืื ื ืืกืชืื ืขื ืืืืื ืื ืฉื Gate1 ื-gate2. ืืืืื ืืืืื ืืฉืืื ืฉืื ืืจืช IPsec ืืืฉืงื ืืืฆืืื, ืืื ืืขืืืช:
root@Gate1:~# cat /var/log/cspvpngate.log
Aug 5 16:14:23 localhost vpnsvc: 00100119 <4:1> IPSec connection 5 established, traffic selector 172.17.0.1->172.16.0.1, proto 47, peer 10.10.10.251, id "10.10.10.251", Filter
IPsec:Protect:CMAP:1:LIST, IPsecAction IPsecAction:CMAP:1, IKERule IKERule:CMAP:1
ืืกืืืืกืืืงื ืฉื ืื ืืจืช IPsec ืขื Gate1 ืื ื ืจืืื ืฉืืืืช ืืฉ ืื ืืจื, ืืื ืืื ื ื-Rัvd ืืืืคืก ืืืคืก:
root@Gate1:~# sa_mgr show
ISAKMP sessions: 0 initiated, 0 responded
ISAKMP connections:
Num Conn-id (Local Addr,Port)-(Remote Addr,Port) State Sent Rcvd
1 3 (10.10.10.251,500)-(10.10.10.252,500) active 1070 1014
IPsec connections:
Num Conn-id (Local Addr,Port)-(Remote Addr,Port) Protocol Action Type Sent Rcvd
1 3 (172.16.0.1,*)-(172.17.0.1,*) 47 ESP tunn 480 0
ืื ื ืืืจืื ืืช S-Terra ืื: ืื ื ืืืคืฉ ืืืื ืืืื ืื ืืช ืืืขื ืื ืชืื ื-R1 ื-R2. ืชืื ืืื (ืกืคืืืืจ) ืืืฆื ืืขืืช.
ืคืชืจืื ืชืงืืืช
ืฉืื 1. ืื ืฉืขืจ1 ืืงืื ื-R1
ืื ื ืืฉืชืืฉ ื-packet sniffer ืืืืื ื - tcpdump. ืื ื ืืฉืืง ืืช ืืกื ืืคืจ ืืืืฉืง ืืคื ืืื (Gi0/1 ืืกืืืื ืืืื ืกืืกืงื ืื eth1 ืืชืืืืช ืฉื Debian OS):
root@Gate1:~# tcpdump -i eth1
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes
14:53:38.879525 IP 172.16.0.1 > 172.17.0.1: GREv0, key=0x1, length 92: IP 1.1.1.1 > 1.1.1.2: ICMP echo request, id 2083, seq 1, length 64
14:53:39.896869 IP 172.16.0.1 > 172.17.0.1: GREv0, key=0x1, length 92: IP 1.1.1.1 > 1.1.1.2: ICMP echo request, id 2083, seq 2, length 64
14:53:40.921121 IP 172.16.0.1 > 172.17.0.1: GREv0, key=0x1, length 92: IP 1.1.1.1 > 1.1.1.2: ICMP echo request, id 2083, seq 3, length 64
14:53:41.944958 IP 172.16.0.1 > 172.17.0.1: GREv0, key=0x1, length 92: IP 1.1.1.1 > 1.1.1.2: ICMP echo request, id 2083, seq 4, length 64
ืื ื ืจืืื ืฉ-Gate1 ืืงืื ืื ืืช GRE ื-R1. ืื ื ืืืฉืื ืืืื.
ืฉืื 2. ืื Gate1 ืขืืฉื ืขื ืื ืืช GRE
ืืืืฆืขืืช ืืื ืืฉืืจืืช klogview ืื ื ืืืื ืืจืืืช ืื ืงืืจื ืขื ืื ืืช GRE ืืชืื ืื ืื ืืืชืงื ืฉื S-Terra VPN:
root@Gate1:~# klogview -f 0xffffffff
filtration result for out packet 172.16.0.1->172.17.0.1, proto 47, len 112, if eth0: chain 4 "IPsecPolicy:CMAP", filter 8, event id IPsec:Protect:CMAP:1:LIST, status PASS
encapsulating with SA 31: 172.16.0.1->172.17.0.1, proto 47, len 112, if eth0
passed out packet 10.10.10.251->10.10.10.252, proto 50, len 160, if eth0: encapsulated
ืื ื ืจืืื ืฉืชืขืืืจืช ืืืขื GRE (ืคืจืืื 47) 172.16.0.1 -> 172.17.0.1 ื ืื ืกื ืชืืช ืืื ืืืฆืคื ื LIST ืืืคืช ืืืฆืคื ื CMAP ืืืืืชื ืืืืืขืช. ืืืืจ ืืื, ืืืืืื ื ืืชืื (ืืชืขืืคื). ืืื ืชืขืืืจืช ืชืืืื ืืคืื klogview.
ืื ื ืืืืง ืืช ืจืฉืืืืช ืืืืฉื ืืืืฉืืจ Gate1. ืื ื ืจืืื ืจืฉืืืช ืืืฉื ืืืช LIST, ืืืืืืจื ืืช ืชืขืืืจืช ืืืขื ืืืฆืคื ื, ืื ืฉืืืืจ ืฉืืืื ืืืืช ืืืฉ ืืื ื ืืืืืจืื:
Gate1#show access-lists
Extended IP access list LIST
10 permit gre host 172.16.0.1 host 172.17.0.1
ืืกืงื ื: ืืืขืื ืืื ืื ืืืืฉืืจ Gate1.
ืขืื ืขื klogview
ืื ืื ื-VPN ืืืคื ืืื ืชืขืืืจืช ืืจืฉืช, ืื ืจืง ืืชืขืืืจื ืฉืฆืจืื ืืืฆืคืื. ืืื ืืืืืขืืช ืื ืจืืืช ื-klogview ืื ืื ืื ื-VPN ืขืืื ืืช ืชืขืืืจืช ืืจืฉืช ืืืขืืืจ ืืืชื ืืื ืืืฆืคื:
root@R1:~# ping 172.17.0.1 -c 4
root@Gate1:~# klogview -f 0xffffffff
filtration result for out packet 172.16.0.1->172.17.0.1, proto 1, len 84, if eth0: chain 4 "IPsecPolicy:CMAP": no match
passed out packet 172.16.0.1->172.17.0.1, proto 1, len 84, if eth0: filtered
ืื ื ืจืืื ืฉืชืขืืืจืช ICMP (ืคืจืืื 1) 172.16.0.1->172.17.0.1 ืื ื ืืืื (ืืื ืืชืืื) ืืืืื ืืืฆืคื ื ืฉื ืืจืืืก ืืืฆืคื ื CMAP. ืืืืืื ื ืืชืื (ืืชืขืืคื) ืืืงืกื ืืจืืจ.
ืฉืื 3. ืื Gate2 ืืงืื ืืฉืขืจ1
ืื ื ืืคืขืื ืืช ืืกื ืืคืจ ืืืืฉืง WAN (eth0) Gate2:
root@Gate2:~# tcpdump -i eth0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
16:05:45.104195 IP 10.10.10.251 > 10.10.10.252: ESP(spi=0x30088112,seq=0x1), length 140
16:05:46.093918 IP 10.10.10.251 > 10.10.10.252: ESP(spi=0x30088112,seq=0x2), length 140
16:05:47.117078 IP 10.10.10.251 > 10.10.10.252: ESP(spi=0x30088112,seq=0x3), length 140
16:05:48.141785 IP 10.10.10.251 > 10.10.10.252: ESP(spi=0x30088112,seq=0x4), length 140
ืื ื ืจืืื ืฉ-gate2 ืืงืื ืื ืืช ESP ื-gate1.
ืฉืื 4. ืื Gate2 ืขืืฉื ืขื ืืืืืืช ESP
ืื ื ืืคืขืื ืืช ืืื ืืฉืืจืืช klogview ื- Gate2:
root@Gate2:~# klogview -f 0xffffffff
filtration result for in packet 10.10.10.251->10.10.10.252, proto 50, len 160, if eth0: chain 17 "FilterChain:L3VPN", filter 21, status DROP
dropped in packet 10.10.10.251->10.10.10.252, proto 50, len 160, if eth0: firewall
ืื ื ืจืืื ืฉืืืืืืช ESP (ืคืจืืื 50) ื ืฉืืื (DROP) ืขื ืืื ืืื ืืืืช ืืืฉ (L3VPN). ืื ื ืืืืื ืฉื- Gi0/0 ืืื ืืฆืืจืคืช ืจืฉืืืช ืืืฉื ื-L3VPN:
Gate2#show ip interface gi0/0
GigabitEthernet0/0 is up, line protocol is up
Internet address is 10.10.10.252/24
MTU is 1500 bytes
Outgoing access list is not set
Inbound access list is L3VPN
ืืืืืชื ืืช ืืืขืื.
ืฉืื 5. ืื ืจืข ืืจืฉืืืช ืืืืฉื
ืื ื ืืกืชืื ืืื ืจืฉืืืช ืืืืฉื ื-L3VPN:
Gate2#show access-list L3VPN
Extended IP access list L3VPN
10 permit udp host 10.10.10.251 any eq isakmp
20 permit udp host 10.10.10.251 any eq non500-isakmp
30 permit icmp host 10.10.10.251 any
ืื ื ืจืืื ืฉืืืชืจ ืื ืืช ISAKMP, ืื ื ืืฆืจืช ืื ืืจืช IPsec. ืืื ืืื ืืื ืืคืขืื ืขืืืจ ESP. ืืื ืื ืจืื, ืืชืืืื ืืืื ืืื icmp ืืืื esp.
ืขืจืืืช ืจืฉืืืช ืืืืฉื:
Gate2(config)#
ip access-list extended L3VPN
no 30
30 permit esp host 10.10.10.251 any
ืฉืื 6. ืืืืงืช ืคืื ืงืฆืืื ืืืืช
ืงืืื ืื, ืื ื ืืืืื ืฉืจืฉืืืช ืืืืฉื ื-L3VPN ื ืืื ื:
Gate2#show access-list L3VPN
Extended IP access list L3VPN
10 permit udp host 10.10.10.251 any eq isakmp
20 permit udp host 10.10.10.251 any eq non500-isakmp
30 permit esp host 10.10.10.251 any
ืืขืช ืื ื ืืฉืืง ืชื ืืขืช ืืขื ืืืืฉืืจ R1:
root@R1:~# ping 1.1.1.2 -c 4
PING 1.1.1.2 (1.1.1.2) 56(84) bytes of data.
64 bytes from 1.1.1.2: icmp_seq=1 ttl=64 time=35.3 ms
64 bytes from 1.1.1.2: icmp_seq=2 ttl=64 time=3.01 ms
64 bytes from 1.1.1.2: icmp_seq=3 ttl=64 time=2.65 ms
64 bytes from 1.1.1.2: icmp_seq=4 ttl=64 time=2.87 ms
--- 1.1.1.2 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3006ms
rtt min/avg/max/mdev = 2.650/10.970/35.338/14.069 ms
ื ืืฆืืื. ืื ืืจืช GRE ืืืงืื. ืืื ื ืืชืขืืืจื ืื ืื ืกืช ืืกืืืืกืืืงืืช IPsec ืืื ื ืืคืก:
root@Gate1:~# sa_mgr show
ISAKMP sessions: 0 initiated, 0 responded
ISAKMP connections:
Num Conn-id (Local Addr,Port)-(Remote Addr,Port) State Sent Rcvd
1 3 (10.10.10.251,500)-(10.10.10.252,500) active 1474 1350
IPsec connections:
Num Conn-id (Local Addr,Port)-(Remote Addr,Port) Protocol Action Type Sent Rcvd
1 4 (172.16.0.1,*)-(172.17.0.1,*) 47 ESP tunn 1920 480
ืืฉืขืจ Gate2, ืืคืื klogview, ืืืคืืขื ืืืืขืืช ืฉืชืขืืืจืช ืืืขื 172.16.0.1->172.17.0.1 ืคืืขื ืื ืืืฆืืื (PASS) ืขื ืืื ืืื LIST ืืืคืช ืืืฆืคื ื ืฉื CMAP:
root@Gate2:~# klogview -f 0xffffffff
filtration result for in packet 172.16.0.1->172.17.0.1, proto 47, len 112, if eth0: chain 18 "IPsecPolicy:CMAP", filter 25, event id IPsec:Protect:CMAP:1:LIST, status PASS
passed in packet 172.16.0.1->172.17.0.1, proto 47, len 112, if eth0: decapsulated
ืชืืฆืืืช ืฉื
ืชืืืื ืืจืก ืื ืืช ืืื ืืืืคืฉ.
ืืืืืจ ืขื ืืืงื ME.
ืืื ืืก ืื ืื ืืื
t.me/anonymous_engineer
ืืงืืจ: www.habr.com